@react-stately/selection

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less verifiable, although the active organization-backed project provides compensating context.

Repo package mentioncaution

The linked repository is a monorepo and does not match or mention this package in its README; while a name mismatch is normal for a sub-package, the lack of a README mention leaves package ownership less transparent.

Workflow auditcaution

All eight workflows were analyzed with no audit findings or untrusted checkout and script-injection sinks, and permissions are mostly read-only or job-scoped. However, all 15 action references are unpinned, which weakens build reproducibility and supply-chain controls.